Privacy Policy

Effective date: June 2, 2026 · Last updated: October 21, 2026 · Jurisdiction: Quebec, Canada

1. Who we are

GradeAid is an AI-assisted grading tool for teachers. A teacher creates an account, provides a rubric (answer key or scoring guide), and submits student work (typed answers, PDFs, or photos of handwriting). GradeAid transcribes that work, proposes a grade with the help of an AI model, and presents every result to the teacher for review before it is used.

The person responsible for the protection of personal information at GradeAid, under Quebec's Act respecting the protection of personal information in the private sector (as modernized by Law 25), is Aiden Benzur, founder. For any privacy question or request (access, correction, portability, or deletion), write to aiden@gradeaidapp.com.

2. The information we handle

(a) Teacher account information. When you register and use GradeAid, we collect and store your name, email address, school (optional), your language preference, a hashed password (a bcrypt hash, never your plaintext password), and the date and version of the privacy policy you accepted when you created the account.

(b) Student data entered or uploaded by teachers. To grade work, teachers enter or upload information about their students, which may include:

• student names and any identifier the teacher chooses to enter;
• submitted work: typed answers, uploaded PDFs, and photos of handwritten work (photos are transcribed and then discarded; the image itself is not kept);
• grades, scores, criterion-level breakdowns, and feedback generated for that work, including any teacher overrides and comments, and, when the teacher asks for them, progress syntheses and report-card comments written from those grades.

This data may include the personal information of minors. It is provided to GradeAid by the teacher or school, not collected by us directly from students. See sections 5 and 7.

(c) Payment information. Paid access is billed through Stripe. Stripe collects and processes your payment details (such as card number) directly. GradeAid does not receive or store your full card details. We store only a Stripe customer/subscription reference and your access status.

(d) Operational data. Our hosting providers process limited technical data needed to run and secure the service (for example, IP addresses and request logs used for rate limiting, abuse prevention, and debugging). In our own logs, teacher names are replaced by a pseudonymous code and secrets are removed.

(e) Feedback and usage signals. We keep the thumbs-up/down and comments you leave on a grade, a record of which copies you reviewed and when, the number of AI calls and tokens used by your account (never their content, kept for cost accounting), and the messages you send us during the beta programme.

3. How we use the information

We use the information only to provide and operate the grading service, specifically to:

• authenticate you and maintain your account;
• transcribe handwritten or uploaded work into text for grading;
• grade student work against your rubric and generate scores and feedback;
• save your classes, students, grades, and overrides so you can review them;
• generate, when you ask for them, progress syntheses, practice material, and report-card comments from the grades you saved;
• review the feedback you leave on grades to find and fix grading errors;
• run the beta programme: activate your access and contact you about your feedback;
• measure usage and costs per account for billing and capacity planning;
• process your subscription and manage access;
• secure the service (rate limiting, abuse prevention) and fix problems.

We do not sell personal information, we do not use student work for advertising, and we do not use it to train AI models (see section 6).

4. How we store and protect it

• In transit: all traffic is encrypted over HTTPS/TLS.
• At rest: data is stored in a managed PostgreSQL database hosted in Canada (Supabase, ca-central-1 region, Montréal).
• In processing: each request is handled by our application servers, which run in the United States, before and after it reaches the database (see section 6).
• Access control: the application checks every request against the signed-in teacher's identity, so each teacher can only reach their own data. Passwords are stored only as bcrypt hashes.
• Payment data: card details are held by Stripe (a PCI-DSS compliant processor), not by us.

Administrative access. The founder can see account-level information (name, email, access status, usage and cost figures, and the history of access grants) in an administrative dashboard, for support and billing. That dashboard has no separate path to student work.

Cookies and browser storage. GradeAid uses only strictly necessary technologies: a session cookie that keeps you signed in (7 days), a language cookie (NEXT_LOCALE, up to one year), and storage on your own device for unsent drafts and upload staging (cleared within 7 days). We use no analytics, advertising, or tracking technology, and we do not profile or locate you.

Protection by default. Without any action on your part, GradeAid applies its most protective settings: no photograph of a copy is kept, no tracking or profiling technology is enabled, no data is transmitted to any recipient other than the providers named in section 6, and no optional feature is switched on for you.

Confidentiality incidents. We keep a register of confidentiality incidents. If an incident presents a risk of serious injury, we notify the Commission d'accès à l'information and the persons concerned with diligence, and we inform the teacher or school concerned without delay.

No system is perfectly secure, and we do not promise absolute security. We take reasonable measures appropriate to the sensitivity of the data.

5. Our roles: teacher/school is the controller, GradeAid is the processor

For the student data described in section 2(b):

• the teacher and/or their school is the controller: they decide what student information to enter and why;
• GradeAid acts as a processor (service provider), handling that data on the teacher's/school's behalf and instructions to deliver grading;
• the teacher is responsible for having the authority and lawful basis to enter student data into GradeAid, including any consent, school authorization, or notice required by their institution and by law. Schools and school service centres can ask us for a written processing agreement.

For the teacher account data in section 2(a), the feedback and usage signals in section 2(e), and the payment data in section 2(c), GradeAid is the controller.

Automated processing and the teacher's judgment

GradeAid uses an AI model to propose a grade, criterion by criterion, with the reasons for each proposal. No decision about a student is made exclusively by automated means: every proposed grade is presented to the teacher for review before it is used, the teacher can see the main factors behind it and change any part of it, and the grade on record is the teacher's. Students and parents may ask the teacher for the reasons behind a grade and to have it reconsidered.

6. Third-party processors

We use the following sub-processors to run GradeAid. Each receives only the data needed for its function. Some operate outside Canada (notably in the United States), which means student work and other data may be processed outside Canada.

AI processing by Google

When you grade work, the student's submitted work is sent to Google's Gemini API to be transcribed and/or scored. GradeAid uses the Gemini API as a paid service, through a Google Cloud project with billing enabled.

Under Google's terms for paid services, Google does not use prompts or responses to improve its products or train its models, and processes them as a data processor under its Data Processing Addendum. Student work is therefore not used to train Google's models.

Google keeps logs of prompts and responses for a limited period, solely to detect abuse and meet legal obligations; those logs may be stored transiently in any country where Google or its agents operate.

Communication outside Quebec. Before entrusting personal information to a provider outside Quebec, we assess the sensitivity of the information, the purposes, the protection measures in place (including contractual ones), and the legal regime of the destination, and we proceed only where the information receives adequate protection. The assessment is reviewed whenever a provider or its location changes.

7. Children's / minors' information

GradeAid is a tool for teachers, not for children. We do not knowingly collect personal information directly from children, and children do not interact with GradeAid. Where a teacher enters work or information about students who are minors, the teacher and their school are responsible for the lawful basis for doing so, including any required consent, authorization, or notice. If you believe a child's information has been entered without proper authority, contact us at aiden@gradeaidapp.com and we will work with the responsible teacher/school to address it.

8. How long we keep data (retention)

We keep personal information only as long as needed for the purposes above, then delete it:

• Teacher accounts and the student data linked to them: for as long as the account is active, so teachers can review past grades.
• Account deletion: you can delete your account yourself from your account page, or ask us by email; the account and all data linked to it are removed from the active database within 30 days of a verified request.
• Photos of handwritten work: transcribed and then discarded; the images are not stored.
• Upload staging (scanned copies awaiting confirmation): at most 7 days, then purged.
• Grading job records, synthesis job records and password-reset links: job records are deleted 7 days after they finish; password-reset links expire after 45 minutes and are deleted within the following hour.
• Usage and cost records: counts of AI calls and tokens, without content, kept for accounting.
• Backups and provider logs: deleted data persists briefly in the database provider's automated backups until they age out, and in our hosting providers' request logs for the limited period their policies allow.
• Payment records held by Stripe are retained per Stripe's policies and applicable financial-record requirements.
• A student's data, at the request of a parent or a school: the responsible teacher can permanently erase everything GradeAid holds about one student from that student's page, in a single operation.

Our full retention schedule is available on request.

9. Your rights and how to exercise them

Under Quebec's Law 25 (Private Sector Act) and Canada's PIPEDA, you have the right to:

• access the personal information we hold about you;
• request correction of inaccurate information;
• receive a copy of the data you gave us in a structured, commonly used format: you can download your complete archive at any time from your account page (“My data”);
• delete your account and associated data, yourself from your account page or by asking us;
• withdraw your consent to the processing of your account information by closing your account;
• ask questions about how your information is handled, and raise a complaint.

To exercise any of these, email aiden@gradeaidapp.com. We respond within 30 days. Because the teacher/school is the controller of student data (section 5), requests about a specific student's information should generally be directed to, or made through, the responsible teacher/school; we will assist the controller in responding.

You may also contact the Commission d'accès à l'information du Québec (CAI) or the Office of the Privacy Commissioner of Canada (OPC) if you have a complaint.

How we handle requests and complaints

Requests. We verify the identity of the person making the request: for an account, a reply from the sign-in email address or an action from the account page is enough; for a student, the request goes through the responsible teacher or school. We record every request in a register (date, nature, outcome — never the content of the data) and answer in writing within 30 days. No fee is charged.

Complaints. A complaint about how we handle personal information goes to the person responsible (section 1). We acknowledge it, examine it and answer in writing within 30 days, stating the measures taken. If the answer does not satisfy you, you may turn to the Commission d'accès à l'information.

Governance. The person responsible maintains written policies on roles and responsibilities, retention and destruction of information (retention schedule), confidentiality-incident management, the assessment of communications outside Quebec, and the handling of requests and complaints. Every person who accesses personal information for GradeAid is bound by them. These policies are reviewed at least once a year and are available on request.

10. Changes to this policy

This policy may change as the product evolves. When we make material changes we update the “Last updated” date above and, where appropriate, notify account holders by email. Prior versions are available on request.

This policy is published in French and English. In case of discrepancy, the French version prevails.

11. Contact

Person responsible for the protection of personal information: Aiden Benzur, founder · aiden@gradeaidapp.com
GradeAid · Quebec, Canada